为何Ansible Vault密码会被传入模块参数且未脱敏？

I get it—running your playbook with -vvv dumps the full module_args including your plaintext password, which is a clear security risk. Even though you're passing credentials via environment variables, since those map directly to module parameters, they still end up in the verbose output.

Here are the most practical fixes to lock this down:

1. Add no_log: true to Sensitive Tasks #

This is the quickest way to block Ansible from logging or displaying sensitive module arguments. Apply it directly to the VCD provisioning task:

- hosts: localhost
  connection: local
  environment:
    env_user: "{{ VCD_USER_NAME }}"
    env_password: "{{ VCD_USER_PASSWORD }}"
    env_host: "{{ VCD_URL }}"
  tasks:
    - name: Complete VCD resource provisioning
      vcd_target_module:
        org: "system"
        # Skip explicit password parameter if your module reads from env vars natively
      no_log: true

When no_log is enabled, Ansible will redact all invocation details (including module_args) for that task. Your password won't show up in console output or logs—even with maximum verbosity.

2. Check if Your VCD Module Supports Native Env Var Reading #

Many cloud/API-focused Ansible modules are built to pull credentials directly from environment variables without needing explicit module_args entries. If your VCD module supports this, you can remove the password parameter from your task entirely. This way, the credential never enters the module argument set at all, eliminating the exposure risk from the start.

3. Validate Ansible Vault Encryption (As an Extra Layer) #

While you're already using --ask-vault-pass, double-check that your VCD_USER_PASSWORD variable is actually stored encrypted in your inventory or variable files. This doesn't fix the verbose output issue directly, but it adds a critical security layer for how your credentials are stored long-term.

The no_log: true approach is the most reliable immediate fix for the output exposure you're seeing—it ensures sensitive data stays hidden no matter how verbose your playbook run is.

内容的提问来源于stack exchange，提问作者tread